BRCGS Food Safety Certification: Requirements and Audit

If you searched for a "BRC certificate" or "BRC audits," you are looking at the BRCGS Global Standard Food Safety, a site-level standard for food manufacturers that an accredited certification body audits against. This guide walks through what the standard requires section by section, how the audit runs, how non-conformities affect the certificate, and what to prepare. It is written for the quality manager or operations lead who has to get the site through it.

What Is BRCGS Food Safety Certification, and Which Issue Applies?

BRCGS Food Safety is a site certification scheme. An approved certification body audits your site against the standard, and if the result supports it, issues a graded certificate and the audit is recorded in the BRCGS Directory, where customers can check supplier status. The scheme is recognized under the Global Food Safety Initiative (GFSI) benchmarking program, and the list of recognized schemes and the version of the GFSI Benchmarking Requirements each was assessed against is published on the GFSI website. That recognition is the reason many retailers and brand owners accept it as a condition of supply. No regulation requires it, so it sits on top of your legal obligations. A US site, for example, still has to meet 21 CFR Part 117 in parallel.

Which issue. The clause references in this guide follow Issue 9 of the standard. BRCGS has issued new versions on a multi-year cycle: Issue 7 was audited from January 2015, Issue 8 from February 2018, and Issue 9 from 1 February 2023. I have not confirmed that a successor to Issue 9 has taken effect as of this update, so before you scope any project, check the BRCGS website's standards page and ask your certification body which issue your audit will use. If a newer issue has replaced it, the section structure below will mostly carry over, but sub-clause numbers and some requirements will not. Where I cite a sub-clause number, check it against your purchased copy of the standard, since the standard text is the only authority.

Scope. The standard covers sites that manufacture, process, or pack food and food ingredients. It does not cover pet food or animal feed, which fall under separate BRCGS arrangements, and it does not cover storage and distribution, packaging materials, or agents and brokers, each of which has its own BRCGS standard.

Who audits. GFSI's benchmarking requirements expect certification bodies to be accredited to ISO/IEC 17065, and BRCGS additionally approves the certification bodies and auditors that may audit its scheme. The certification body requirements are set out in the standard's own certification body part.

If you are still choosing a scheme, our comparison of BRC, SQF, and HACCP shows how they differ in practice.

What Does the Standard Require? A Walkthrough of the Seven Sections

Issue 9 is organized into seven requirement sections.

A subset of clauses are designated fundamental. A failure of a fundamental clause is treated more seriously because it suggests the system cannot be relied on. Issue 9 lists the fundamental clauses in the standard itself, and the headline ones are senior management commitment, the food safety plan, internal audits, corrective and preventive action, and traceability. Read the list in your copy rather than relying on a summary, because it has changed between issues.

Section 1: Senior Management Commitment

Auditors usually read this section first, because if management is not visibly in charge, the rest tends to be paperwork.

• Clause 1.1, commitment and policy. A signed food safety and quality policy that staff can describe in their own words, plus objectives and a recorded management review at least annually.
• Clause 1.1.2, culture plan. The plan has to include defined activities, an action plan with timescales and a way to measure each activity, and a review of effectiveness. The common failure is a plan with actions but no measurement, such as a training session recorded as an attendance sheet with no check on whether behavior changed.
• Resources and communication. A documented organization chart, defined responsibilities, and a confidential route for staff to raise food safety concerns.

A practical test: ask an operator what the food safety policy means for their job. If the answer is a shrug, the auditor will find that out too.

Section 2: The Food Safety Plan (HACCP)

The clauses in section 2 follow the Codex Alimentarius HACCP principles, and this is a fundamental section, so a major here is expensive. What the auditor expects to see:

1. A HACCP team with product, process, and HACCP knowledge, and a leader trained in the Codex principles (clause 2.1).
2. Prerequisite programs such as hygiene, maintenance, pest control, and cleaning, documented and verified.
3. Product descriptions, intended use, and flow diagrams that have been checked on the floor. Auditors walk the line against your diagram and note every difference.
4. A hazard analysis covering biological, chemical, physical, and allergen hazards, with the rationale for what is and is not significant.
5. CCPs with critical limits, monitoring, and corrective actions.
6. Validation, verification, and review. The plan is validated before use, reviewed at least annually, and reviewed again when product, process, or ingredients change.

In my view the most common audit finding is not a flawed hazard analysis. It is a flow diagram that was not updated after a line change, or CCP monitoring records that do not match what the plan says is monitored.

Section 3: Food Safety and Quality Management System

This is the paperwork-heavy section. The sub-clauses to know:

• 3.2 and 3.3, document control and records. Controlled procedures and records that are legible, retrievable, and kept for a defined period.
• 3.4, internal audits. A scheduled program covering the whole standard, which clause 3.4.1 sets at a minimum of four different audit dates through the year, carried out by trained auditors who are independent of the area audited. Hygiene and fabrication inspections run as a separate program. Starting your internal audits a month before the certification audit does not meet this.
• 3.5, supplier and raw material approval. A documented risk assessment for each raw material and a risk-based approval and monitoring process for suppliers, including suppliers of services and outsourced processing. A spreadsheet of approved names is not a risk process.
• 3.7, corrective and preventive action. Root cause, not just a fix. The auditor will pull closed actions and ask what stopped it from happening again.
• 3.9, traceability. The standard requires you to test traceability across your product groups at least annually, from raw material to customer and back, and the test includes a quantity reconciliation (mass balance). The time allowed to complete a trace is four hours. Confirm the wording of the reconciliation tolerance in your copy, and write your own defined tolerance into the procedure. Run the test yourself more than once a year, because the auditor will run one on the day.
• 3.10 and 3.11, complaints and incidents. Documented complaint handling with trend analysis, and an incident, withdrawal, and recall procedure that has been tested.

Section 4: Site Standards

This is where much of the on-site time goes. Expect a physical walk of the full facility, including roofs and exteriors.

• Layout and product flow (4.3). Segregation of raw from ready-to-eat product, and of allergens.
• Building fabric, utilities, and equipment. Floors, walls, drains, lighting, and where water, compressed air, or steam contacts product.
• Chemical and physical contamination control (4.9). Glass and brittle plastic registers, controlled use of knives and blades, and chemical control.
• Foreign body detection (4.10). Metal detection or X-ray where the risk assessment calls for it, with documented test routines, rejection checks, and what happens after a failure.
• Housekeeping and hygiene (4.11). Cleaning procedures and verification.
• Pest management (4.14). A competent provider or trained team, activity trending, and proofing.

Small findings add up. One cracked tile is a minor. Twelve of them, plus damaged door seals, starts a grade conversation.

Section 5: Product Control

• 5.1, design and development. Shelf-life setting supported by evidence, and a process for changes to recipes or formulations.
• 5.2, labeling. Legal label review against the market where the product is sold.
• 5.3, allergen management. A documented allergen risk assessment, physical or time segregation, validated cleaning at changeover, controls on rework, and a justified basis for any precautionary labeling. Cleaning validation at allergen changeovers is a frequent weak spot, because sites verify that cleaning happened but not that it works.
• 5.4, authenticity, claims, and chain of custody. A food fraud vulnerability assessment and a documented mitigation plan, reviewed at least annually.
• 5.5 to 5.7, packaging, inspection and testing, and release. Packaging suitability, testing against specification, and a defined product release procedure.

Section 6: Process Control

• 6.1, control of operations. Documented process specifications, verification of line settings at start-up and changeover, and a change control route.
• 6.2, labeling and pack control. Line clearance and label verification, with records. Wrong-label events usually start with a missed line clearance.
• 6.3, quantity control. Weight, volume, or count checks to the frequency your legal requirements and customers set.
• 6.4, calibration. Measuring and monitoring devices, including thermometers, scales, and metal detectors, calibrated against traceable standards. Auditors ask for these records on the spot.

Section 7: Personnel

• 7.1, training. Induction plus role-based training with competence assessed, covering agency and temporary workers. The CCP monitor has to be trained in what to do when a limit is missed, not just how to take the reading.
• 7.2, personal hygiene. Handwashing, jewelry, hair and beard covering, and rules on eating and smoking.
• 7.3, medical screening. A procedure for staff to report infectious disease or symptoms, with defined exclusion and return-to-work rules.
• 7.4, protective clothing. Clothing suitable for the area, laundering under a controlled standard, and separate clothing where high-risk, high-care, or ambient high-care zones apply.

How Does the BRCGS Audit Process Work?

The standard's audit protocol (Part III) contains the audit duration calculation, which is built from factors such as the number of employees and the number and complexity of HACCP studies and processes. Ask your certification body for the calculation behind the quote you receive, not just the day count. As a rule of thumb, small and simple sites sit around two days, but the number is theirs to justify.

Announced vs. Unannounced Audits

You choose between an announced audit program and an unannounced one. For unannounced audits, the certification body picks the date within a window defined in Part III, and you do not get to know it in advance. In Issue 9 the audit type is shown on the certificate and in the Directory entry, and it is not a suffix on the grade. Some customers prefer or require the unannounced option. If you choose it, you have to operate as if the auditor could arrive any morning, which in my view is a better operating discipline anyway.

How Are Non-Conformities Graded?

The result is a grade of AA, A, B, C, or D. The number of minor non-conformities, and whether there are any majors, drive the grade, and the grade drives how soon you are audited again. As I read Part III, higher grades carry a 12-month audit frequency and lower grades a shorter one of six months. I am not reproducing the minor-count thresholds for each grade here. They are set in the grading table in Part III, they have shifted between issues, and I cannot check them against your edition from this page. Pull the table from your copy and plan against it, because it tells you exactly how many minors cost you a grade.

Two timelines to put on your calendar, both set in Part III: you must submit corrective action evidence to the certification body within 28 calendar days of the audit, and the standard's target for the certification decision is 42 days from the audit date, assuming timely responses. If either figure differs in your edition, trust the edition.

How Long Does BRCGS Preparation Take?

For a site with a working GMP and HACCP foundation, a realistic sequence looks like this:

1. Weeks 1 to 2: gap analysis against the current issue, clause by clause, producing a prioritized list.
2. Weeks 3 to 10: close structural gaps. HACCP review, supplier risk assessments, culture plan, and internal audit schedule.
3. Weeks 8 to 14: run the system. Records need time to exist, and four internal audit dates cannot be backfilled.
4. Weeks 12 to 16: mock audit by someone who will tell you the truth, including a full trace and a recall exercise.
5. Week 16 onward: book the certification audit and close the mock audit findings.

Sites starting from scratch should plan for six to twelve months, because the standard wants evidence of a system that has been running, not one that has just been written. A gap analysis and mock audit are the two steps where an outside view pays off most. Our BRC consulting services page describes how we support them.

Preparation Checklist

Management and culture

• [ ] Signed, current policy and objectives
• [ ] Culture plan with actions, owners, dates, and measured results
• [ ] Management review held with recorded decisions

HACCP

• [ ] Trained team with training records
• [ ] Flow diagrams verified on the floor after the latest change
• [ ] Hazard analysis current and CCPs validated
• [ ] Monitoring records match the plan

Management system

• [ ] Internal audits completed on at least four dates, with hygiene inspections separate
• [ ] Raw material and supplier risk assessments
• [ ] Corrective actions closed with root cause
• [ ] Traceability test with reconciliation done inside four hours, plus a recall exercise

Site and product

• [ ] Pest trends reviewed and foreign body registers current
• [ ] Metal detector or X-ray challenge tests recorded
• [ ] Allergen risk assessment and changeover cleaning validation
• [ ] Food fraud vulnerability assessment

Process and people

• [ ] Calibration records for thermometers, scales, and detectors
• [ ] Competence records for permanent, agency, and contract staff
• [ ] Illness reporting procedure in force

Frequently Asked Questions

What is a BRCGS certificate?

It is the graded certificate issued by an approved certification body after a successful audit against the BRCGS Global Standard Food Safety. The audit is recorded in the BRCGS Directory, where customers can verify it.

Is BRCGS certification mandatory?

No regulation requires it. It is usually a customer condition of supply, and it does not replace legal compliance such as 21 CFR Part 117 for US sites.

How often are BRCGS audits held?

Per Part III of the standard, higher grades are audited every 12 months and lower grades more often, so your grade sets your next audit date. Check the grading table in your edition.

What happens if I get a major non-conformity?

No certificate is issued until the certification body accepts your evidence of correction, and a follow-up audit may be needed. A critical non-conformity means certification is not granted or is withdrawn.

Does BRCGS Food Safety cover pet food or storage?

No. Pet food and animal feed fall under separate BRCGS arrangements, and storage and distribution has its own BRCGS standard.

Last updated: 2026-10-03